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This listing of claims will replace all prior versions, and listings, of claims in the application: 


1. (Currently Amebded) A security system for a computer connected to a network of 
computers comprising: 

at least one security subsystem associated with said computer, said subsystem being 
configured to automatically and without human control correlate events across a plurality of 
devices associated with said network of computers and to detect attacks on said computer; 

and a secure link between said security subsystem and a master system enabling data 
communication therebetween; wherein 

said master system automatically and without human control monitors said security 
subsystem through said secure link and registers information pertaining to attacks detected by 
said security subsystem. 1 


2. (Original) The secumty system of Claim 1 further comprising a pseudo attack 
generator associated with said master system for generating attacks on said computer detectable 
by said security subsystem wherein said master system monitors said security subsystem by 
comparing said pseudo-attacks to said attacks detected by the security subsystem. 

3. (Original) The security system of Claim 1 wherein said master system is hierarchically 
independent from said security subsystem. 


Listing of Claims : 


4. (Original) The security system of Claim 1 wherein said security subsystem is 
hierarchically subordinate to said master system. 
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5. (Currently Amended) A network security system for a target network of computers 
comprising: \ 

at least one security subsystem associated with said target network, said subsystem being 
configured to automatically and without human control correlate events across a plurality of 
devices associated with said! target network of computers and to detect attacks on said network; 
and I 

a secure link between said security subsystem and a master system enabling data 
communication therebetween;\wherein 

said master system automatically and without human control monitors said security 
subsystem through said secure link and registers information pertaining to the attacks detected by 
said security subsystem. \ 

6. (Original) The network security system of Claim 5 wherein said master system is 
hierarchically independent from said security subsystem. 

7. (Original) The network security system of Claim 5 wherein said security subsystem is 
hierarchically subordinate to said master system. 

8. (Currently Amended) A network security system for a target network of computers 
comprising: \ 
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at least one security subsystem associated with said target network and configured to 
automatically and without human control correlate events across a plurality of devices associated 
with said target network aAd to detect and register attacks on said target network; 

a secure link for data communication between said security subsystem and said master 
system; and \ 

testing means associated with said master system for generating pseudo-attacks on said 
target network initiated by said master system and detectable by said security subsystem; wherein 

said master system automatically and without human control monitors said security 
subsystem through said secure link by comparing the pseudo-attacks generated by said testing 
means to the detected attacks registered by said security subsystem. 

9. (Original) The networli security system of Claim 8 wherein said master system is 
hierarchically independent from said security subsystem. 

10. (Original) The network security system of Claim 8 wherein said security subsystem 
is hierarchically subordinate to said master system. 

1 1 . (Currently Amended) A method for monitoring the integrity of a security subsystem 
associated with a target network of computers and configured to detect attacks on said network 
of computers comprising: \ 

automatically and without human control correlating events across a plurality of devices 
associated with said target network usingkaid security subsystem; 
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establishing a secure link for the transfer of data between said security subsystem and a 
master system hierarchically independent from said security subsystem; 

automatically andlwithout human control monitoring the status of said security subsystem 
through said secure link; and 

registering information pertaining to the status of said security subsystem. 


12. (Original) The rqethod for monitoring the integrity of a security system of Claim 1 1 
including the steps of: 

connecting said mast^f system and said target network separately to an open network of 
computers; 

generating at least one bseudo-attack in said master system, said pseudo attack being 
detectable by said security subsystem; 

generating in said maste^ system a list of expected responses to said at least one pseudo- 
attack; 

delivering said at least onip pseudo-attack over said open network to said target network; 

and 

comparing the response of ^aid security subsystem to said pseudo-attack to the list of 
expected responses thereto. 


13. (Currently Amended) A security system for a computer connected to a computer network 
comprising: 

at least one detection means associated with said computer, said detection means being 
configured to automatically and without human control correlate events across a plurality of 
devices associated with said computer network and to detect an attack on said computer; 

a master security system located c^utside said computer network; and 
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a secure link between said detection means and said master security system enabling data 
communication therebetween; wherein 

said master security system automatically and without human control monitors said 
detection means through s|aid secure link and registers information pertaining to attacks detected 
by said detection means. 

14. (Original) The security system of Claim 13, wherein said detection means is 
one or more selected from tjhe group consisting of an intrusion detection system, a firewall and a 
security subsystem. 

15. (Original) The security system of Claim 13, wherein said master security 
system is hierarchically independent from said detection means. 

16. (Original) Tlhe security system of Claim 13 further comprising a pseudo 
attack generator associated withtsaid master security system for generating attacks on said 
computer detectable by said detection means wherein said master security system monitors said 
detection means by comparing saip pseudo-attacks to said attacks detected by said detection 
means. 


17. (Currently Amended) A network security system for a target network of computers 


comprising: 
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at least one detection means associated with said target network, said detection means 
being configured to automatically and without human control correlate events across a plurality 
of devices associated wiffli said computer network and to detect an attack on said network; 

a master security system located outside said network; and 

a secure link between said detection means and said master security system enabling data 
communication therebetween; wherein 

said master security system automatically and without human control monitors said 
detection means through said $ecure link and registers information pertaining to attacks detected 
by said detection means. 

18. (Original) The network security system of Claim 17, wherein said detection 
means is one or more selected from the group consisting of an intrusion detection system, a 
firewall and a security subsystem.! 

19. (Original) The network security system of Claim 17, wherein said master 
security system is hierarchically independent from said detection means. 


20. (Original) The network security system of Claim 1 7 further comprising a 
pseudo-attack generator associated with said master security system for generating attacks on 
said target network detectable by said detection means wherein said master security system 
monitors said detection means by compalfing said pseudo-attacks to said attacks detected by said 
detection means. 
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2 1 . (Currently Amended) A method for monitoring the integrity of a detection 
means associated with a computer, said computer being connected to a computer network, and 
configured to detect an attack on said computer, said method comprising the steps of: 

automatically and w ithout human control correlating events across a plurality of devices 
associated with said compui er network using said detection means; 

establishing a secure! link for the transfer of data between said detection means and a 
master system hierarchicallylindependent from said detection means; 

automatically and without human control monitoring the status of said detection means 
through said secure link; and 

registering information pertaining to the status of said detection means. 


22. (Currently Amendedh A method for monitoring the integrity of a detection means 
associated with a target network pf computers and configured to detect an attack on said network 
of computers comprising the steps of: 

automatically and without human control correlating events across a plurality of devices 
associated with said target networw using said detection means; 

establishing a secure link for the transfer of data between said detection means and a 
master system hierarchically independent from said detection means; 

automatically and without huqian control monitoring the status of said detection means 
through said secure link; and 

registering information pertainfeig to the status of said detection means. 
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